REMARKS 



Claim 4 has been cancelled. Claims 1, 7, 16, and 17 have been amended to clarify the 
subject matter regarded as the invention. Claims 1-3 and 5-17 remain pending. 

The specification has been amended to delete the claim of priority to which the Examiner 
objected. 

The attached replacement drawings, and the amendments to the specification with respect 
to Figure 6, are believed to overcome the objections to the drawings. 

The amendments to claim 7, which are supported without limitation in the application at 
page 90, line 7 - page 91, line 20, are beUeved to overcome the rejection of claims 7-12 under 35 
use 112, second paragraph. 

The amendments to claims 1 and 16 are believed to overcome the rejection of claims 1- 
16 under 35 USC 101. With respect to claim 1, and claims 2-15 which depend from claim 1, the 
claim has been amended to recite that the analysis engine comprises a processor and to specify 
more clearly the concrete, useful, and tangible result that may be produced through a practical 
application of the recited system. Claim 16 has been amended to specify more clearly the 
concrete, useful, and tangible result that may be produced through a practical application of the 
recited method. As such, claims 1-16 are believed to satisfy the requirements of 35 USC 101. 

The rejection of claims 7-12 under 35 USC 101 is believed to be overcome by the 
amendment to claim 7, which specifies more clearly how continuations are used in the system of 
claim 7. 
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The Examiner has rejected claims 1-17 under 35 USC 102(a) as being anticipated by 
Thuraisingham. 

The rejection is respectfully traversed. With respect to claim 1, Thuraisingham describes 
a system and method for detecting security violations in a multilevel secure database. While the 
Office Action notes correctly that Thuraisingham describes a rule-based system, and further 
describes using forward chaining and backward chaining in the context of such a system, 
Thuraisingham does not provide an enabling disclosure of a hybrid system in which both forward 
chaining and backward chaining are used as recited in claim 1 . While Thuraisingham makes 
passing mention of the fact that such a hybrid approach "has also been proposed", 
Thuraisingham at col. 17, lines 41-43, Thuraisingham does not enable such an approach. The 
discussion in Thuraisingham at col. 24, lines 16-42, describes how either forward chaining or 
backward chaining may be implemented using the Prolog language, it does not describe how the 
two could be used together in a hybrid approach as disclosed by applicants and as recited in 
claim 1 . Specifically, Thuraisingham does not teach "(i) using forward chaining to generate one 
or more inferences; (ii) determining which, if any, of the inferences matches a sub-goal 
associated with a rule fi-om the source of rules; (iii) with respect to each inference that matches a 
sub-goal, applying backward chaining from that sub-goal's potential parents into other sub-goals; 
and (iv) for each sub-goal reached either by forward or backward chaining, determining whether 
the sub-goal indicates an intrusion has taken place," as recited in claim 1. As such, claim 1 is 
believed to be allowable. 

Claims 2-15 depend from claim 1 and are believed to be allowable for the same reasons 
described above. 
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Claims 16 and 17 have been amended similarly to claim 1 and are believed to be 
allowable for the same reasons described above. 

Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 



Respectfully submitted, 




WiUiam J. James 
Registration No. 40,661 



V 408-973-2592 
F 408-973-2595 



VAN PELT AND YI, LLP 
10050 N. Foothill Blvd., Suite 200 
Cupertino, CA 95014 
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Replacement drawing 
Appln, No. 09/651,439 
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